feat(egress): a ceiling no answer can exceed, and a diff of what a policy change opens

[praxagent]

Idea credit: NVIDIA OpenShell's policy prover (policies must stay within an allowed access boundary; flag proposed rules that add risky access).

Ceiling — PROXY_EGRESS_CEILING (opt-in)

• The ceiling is an outer boundary, written in the same format as the policy.
• It is checked before the policy on every request.
• Anything outside it is denied outright and never asked about, so no person's answer, timed grant or later policy edit can exceed it.
• At startup the proxy logs every policy rule that reaches past it.
• Unset means no change.
• Compose mounts ${PROXY_EGRESS_CEILING_FILE:-./egress-ceiling.example.json}.

Diff — python -m secrets_proxy.egress_policy diff OLD NEW [--ceiling C] [--forward-map M]

• It lists every request the new policy treats more permissively than the old one.
• It marks the ones that would carry an injected credential, and the ones the ceiling refuses anyway.
• It exits 1 if anything opened, so it can gate a deploy.
• Not a proof: it compares the two policies only over the vocabulary their own rules use (hosts, methods, ports and paths, each clean and tainted) plus "any other host".

Tests

• 8 new tests in tests/test_policy_ceiling.py, including: the ceiling beats an allow rule and a remembered answer; the diff finds new allows and credential-bearing opens; the CLI exit codes.
• Full suite: 71 passed; ruff clean; docker compose config valid.
• Not exercised live against mitmproxy in this PR.

[praxagent]

Folded into #8 (stacked PRs re-conflict after every squash merge). Every commit from this branch is in #8 — merge that one.